There was an off-by-one when writing the check for valid file descriptor
values, resulting in fd 0 not beign usable with FdExt::get_fdinfo_field.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

RHEL 8 backported the fd-based mount API to their 4.18 kernel, but based
on testing in runc it seems there is a pretty serious performance bug in
their backport that makes it unusable. To avoid using any such broken
backports, we refuse to even try to use the new mount API if the running
kernel is older than when the fd-based mount API was merged (Linux 5.2).

This mirrors logic we have in pathrs-lite.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

The "ino" field was added to /proc/$pid/fdinfo/$n in Linux 5.14
(by kcommit 3845f256a8b52 ("procfs/dmabuf: add inode number to
/proc/*/fdinfo")), which means that we cannot require it exist on any
kernels older than that.

Unfortunately this does weaken the non-openat2 case somewhat (on
pre-5.14 kernels, an attacker can now use a single /proc/self/environ
file to fake any fdinfo) but there doesn't appear to be nice way of
authenticating the fdinfo file we read from:

 * The inode number of fdinfo files is randomly generated and thus can't
   be used to figure out what fdinfo file it is, nor that it is an
   authentic fdinfo file at all.

 * The "flags" field would present no real barrier to attackers because
   in practice in libpathrs it will always be "02", and there isn't
   really

 * You could imagine using the "pos" field as a very rudimentary
   challenge-response mechanism (lseek() to a random offset in the fd
   and then check that the fdinfo contains the same offset in the "pos"
   field). The hope is that it would be too difficult for an attacker to
   mirror challenge in their fake fdinfo file. Unfortunately, this is
   not workable for several reasons:

   - We are almost always dealing with O_PATH file descriptors in
     libpathrs when looking at fdinfo, which means we cannot use
     lseek() in the first place.

   - The seek position is global state for the file descriptor so we
     would need to take a &mut version of BorrowedFd, but no such API
     really exists and &mut OwnedFd is very unergonomic.

   - Most importantly, this is _really_ ugly.

Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>